1。安全远程访问对私人应用程序的安全访问许多企业仍使用旧版VPN来为远程员工提供网络访问权限和扩展的业务生态系统用户,他们只需要访问有限的私人应用程序。然而,有65%的企业正在考虑从传统VPN转换转换,而有利于另一种远程访问替代方案(2022 VPN风险报告,网络安全内部人士)。因此,许多组织可能会发现自己转向零信任网络访问(ZTNA)技术。通过将ZTNA的优先级用于关键业务应用程序,IT和安全团队可以显着降低风险,同时为业务提供更好的用户体验。
带有VPN连接到公司资源的托管设备带有许多问题,包括差的用户经验,复杂的管理和安全威胁。使用VPN可以增加客户端服务器应用程序的滞后,尤其是如果员工的带宽和高潜伏期连接时。BYOD程序很容易消费,并且一旦实施就可以使用。它具有更好的用户体验,更易于管理,并且一旦安装和配置了BYOD程序,就可以采取出色的安全措施。与VPN相比,用BYOD解决方案隔离威胁也更容易,一旦用户可以访问公司资源,就很难删除其访问权限。
Cross-premises connectivity VPN Gateway VPN Gateway Cloud VPN Gateway DNS management Route 53 DNS Cloud DNS DNS-based routing Route 53 Traffic Manager Cloud DNS Dedicated network Direct Connect ExpressRoute Cloud Interconnect Load balancing Network Load Balancer Load Balancer Network Load Balancing Application-level load balancing Application Load Balancer Application Gateway Global Load Balancing Route table Custom Route Tables User Defined Routes Routes Private链接privateLink azure私人链接私人服务连接私人PAAS连接VPC端点私人端点私人服务连接
Cross-premises connectivity VPN Gateway VPN Gateway Cloud VPN Gateway DNS management Route 53 DNS Cloud DNS DNS-based routing Route 53 Traffic Manager Cloud DNS Dedicated network Direct Connect ExpressRoute Cloud Interconnect Load balancing Network Load Balancer Load Balancer Network Load Balancing Application-level load balancing Application Load Balancer Application Gateway Global Load Balancing Route table Custom Route Tables User Defined Routes Routes Private链接privateLink azure私人链接私人服务连接私人PAAS连接VPC端点私人端点私人服务连接
Change Log 5 Getting started 6 Registration 6 Basic configuration 6 Resources 7 Administrator access 9 Management network 9 User authentication for management network access 9 Who can access the FortiGate 9 What can administrators access 10 How can users access the FortiGate 10 Administrative settings 10 Day to day operations 12 Configuration changes 12 Policy configuration changes 13 Logging and reporting 14 Performance monitoring 14 Identity and access management 15 Certificates 17 Certificate usage 17 Security profiles 19 Opened ports for Authentication Override在Web滤清器中替换消息中20 SSL/TLS深度检查21迁移23使用配置文件手动迁移配置24远程访问26 SSL VPN 26 IPSEC VPN 27非VPN 27非VPN远程访问27高可用性和高可用性28高可用性28高可用性28高可用性28
Change Log 5 Getting started 6 Registration 6 Basic configuration 6 Resources 7 Administrator access 9 Management network 9 User authentication for management network access 9 Who can access the FortiGate 9 What can administrators access 10 How can users access the FortiGate 10 Administrative settings 10 Day to day operations 12 Configuration changes 12 Policy configuration changes 13 Logging and reporting 14 Performance monitoring 14 Identity and access management 15 Certificates 17 Certificate usage 17 Security profiles 19 Opened ports for Authentication Override在Web滤清器中替换消息中20 SSL/TLS深度检查21迁移23使用配置文件手动迁移配置24远程访问26 SSL VPN 26 IPSEC VPN 27非VPN 27非VPN远程访问27高可用性和高可用性28高可用性28高可用性28高可用性28
Change Log 5 Getting started 6 Registration 6 Basic configuration 6 Resources 7 Administrator access 9 Management network 9 User authentication for management network access 9 Who can access the FortiGate 9 What can administrators access 10 How can users access the FortiGate 10 Administrative settings 10 Day to day operations 12 Configuration changes 12 Policy configuration changes 13 Logging and reporting 14 Performance monitoring 14 Identity and access management 15 Certificates 17 Certificate usage 17 Security profiles 19 Opened ports for Authentication Override在Web滤清器中替换消息中20 SSL/TLS深度检查21迁移23使用配置文件手动迁移配置24远程访问26 SSL VPN 26 IPSEC VPN 27非VPN 27非VPN远程访问27高可用性和高可用性28高可用性28高可用性28高可用性28
•隧道:站点到站点,轮毂和辐条,动态端点,AUTOVPN,ADVPN,组VPN(IPV4/ipv6/dual stack)•杜松安全连接:远程访问/ssl vpn•配置有效载荷:yes yes y yes•ike Engryption angorthms:ike Engryption algorithms:prime,prime,prime,des-cbc,3dees-cbc,aec-cb cm,aec-cb cm cb cb cb cb cb cb cb cb cb cb cb• IKE authentication algorithms: MD5, SHA-1, SHA-128, SHA-256, SHA-384 • Authentication: Pre-shared key and public key infrastructure (PKI) (X.509) • IPsec: Authentication Header (AH)/Encapsulating Security Payload (ESP) protocol • IPsec Authentication Algorithms: hmac-md5, hmac-sha-196, hmac-sha-256 • IPsec Encryption Algorithms: Prime, DES-CBC, 3DES-CBC, AEC-CBC, AES-GCM, Suite B • Perfect forward secrecy, anti-reply • Internet Key Exchange: IKEv1, IKEv2 • Monitoring: Standard-based dead peer detection (DPD) support, VPN monitoring • VPNs GRE, IP-IP和MPLS
Change log 4 Getting started 5 Registration 5 Basic configuration 5 Resources 6 Administrator access 8 Management network 8 User authentication for management network access 8 Who can access the FortiProxy 8 What can administrators access 9 How can users access the FortiProxy 9 Administrative settings 9 Day to day operations 10 Configuration changes 10 Logging and reporting 11 Performance monitoring 12 Identity and access management 13 Certificates 14 Certificate usage 14 Security profiles 16 SSL/TLS deep inspection 17 Migration 18 Remote access 19 SSL VPN 19 IPsec VPN 20 Non-VPN remote access 20 High availability and redundancy 21 High availability 21 Redundant and aggregate links 21 Disaster recovery 22 Network security 23 Policies 23 VPN 24 Hardening 25 Tips to avoid bottlenecks 27 Source port exhaustion for webproxy-forward-server 27 Balancing loads among WAD workers 30